Razack2k

[Stephen Fewer @stephenfewer]

Today we have published the technical analysis and PoC for CVE-2026-55040, the Microsoft SharePoint authentication bypass we disclosed last month: https://t.co/derBtFMXYm

[Dark Web Informer @DarkWebInformer]

🚨Nightmare Eclipse has released a new zero-day PoC called ShieldBreak

Per the security researcher: "Microsoft has failed to properly patch the RoguePlanet vulnerability CVE-2026-50656, this PoC demonstrates a full patch bypass."

GitHub: https://t.co/vWNuceIYcP

[blueblue @piedpiper1616]

GitHub - sgkdev/bad_garbage: CVE-2026-53361 AF_UNIX GC vs MSG_PEEK use-after-free container escape · GitHub - https://t.co/kgp9SlHzhE

[ThreatWire @ThreatWire_]

🚨 IN THE WILD: CVE-2026-63077, a critical unauthenticated RCE in JetBrains TeamCity, is now being actively exploited.

A public PoC is also available, significantly increasing the risk to unpatched servers.

PoC: https://t.co/Rrf7wSZ4Gs

#TeamCity #JetBrains #CVE #RCE #CyberSecurity #Infosec #PoC

[Ani @aniziki]

Thanks defcon for all the fun!

Let’s drop a vuln I’ve been looking into during the con!

There is a pre-authentication out-of-bounds write in uboot in the IPv6 receive path, reachable from a single link-local DHCPv6 ADVERTISE.

net_ip6_handler() (net/net6.c:426, :442) passes the wire-supplied UDP length to the DHCPv6 client without checking it against the number of bytes actually received.

The client then acts on that length: dhcp6_send_request_packet()
(net/dhcpv6.c:244) copies an attacker-declared number of bytes past the net_pkt_buf transmit buffer.

When the copy overruns onto the push_packet function pointer (net/net.c:1201), uboot calls it on the next received frame, which runs that frame's bytes as a command line via run_command().

The result is pre-authentication remote code execution in the bootloader!

uboot MUST be compiled with CONFIG_IPV6=y and CONFIG_CMD_DHCP6=y to work

confirmed and reproduced two ways:
 + QEMU qemu_arm64 over virtio-net: an injected command (e.g. "echo ...") runs and prints on the console.

 + Physical Raspberry Pi 4 (bcmgenet): the same ADVERTISE redirects
the program counter to the planted run_command address.
The Synchronous-Abort elr equals the injected value.

[Panos Gkatziroulis 🦄 @ipurple]

ResetNightmare POC - a validation flaw in the Kerberos Change Password protocol that allows for resetting the password of any target user/computer account, without knowing the current one.
https://t.co/b0LW72pQOp

[0xedh @0xedh]

You don't need a USB. You need to look like one.

Emulate the device, Windows fetches a signed package off Windows Update and runs vendor code as SYSTEM. Arbitrary code execution, LPE, standard user or empty logon screen.

DEF CON 34 talk w/ @Qm9yamFN.
Link at the first comment.

[Blackstorm Security @blackstormsecbr]

CVE-2026-24294 - Local NTLM Reflection LPE via SMB Arbitrary Port:

https://t.co/mgzW4iZsOB

#smb #vulnerability #infomationsecurity #infosec #cybersecurity #exploit #exploitation

[ThreatWire @ThreatWire_]

🚨 A public PoC is available for CVE-2026-64600, a Linux kernel vulnerability affecting XFS.

The flaw involves stale data fork mappings after an ILOCK cycle, potentially impacting filesystem integrity.

🔗 https://t.co/FGCDdNQKeD

#Linux #XFS #CVE #CyberSecurity

[ThreatWire @ThreatWire_]

🚨 A public PoC is available for CVE-2026-66066 affecting Ruby on Rails Active Storage.

🔗 https://t.co/BL3Umk7cLx

#RubyOnRails #RCE #CVE #CyberSecurity

[Dark Web Informer @DarkWebInformer]

‼️ CVE-2026-43503: DirtyClone is a Linux kernel local privilege escalation (LPE) vulnerability caused by page-cache corruption.

PoC: https://t.co/UEyVdmvLZ3

[moton @moton]

CVE-2026-42530: NGINX HTTP/3 RCE PoC Disclosed - https://t.co/vJc09y3618

[ThreatWire @ThreatWire_]

🚨 A public PoC has been released for CVE-2026-57239 affecting Foxit PDF Reader and Foxit PDF Editor

The flaw allows a local privilege escalation (LPE) to NT AUTHORITY\SYSTEM via the applications update mechanism Patched in the latest releases

🔗 https://t.co/rLEqEpJ5LO

#Foxit

[H4x0r.DZ 🇰🇵 @h4x0r_dz]

https://t.co/H4SVpAdXOc

[Daily CyberSecurity @Daily_CyberSec]

CVE-2026-60004 is a critical Gitea RCE via a diffpatch Git hook, rated CVSS 9.8. Full details and a public PoC are out. Update to Gitea 1.27.1 now.
#Gitea #CVE202660004 #RCE #RemoteCodeExecution #GitHook #CyberSecurity
https://t.co/hVRO5wimo8

[b33f | 🇺🇦✊ @FuzzySec]

Quick POC using @nebusecurity CVE-2026-43499 to root my bootloader locked US S25 (SM-S931U1). Btw this works on latest fw. This phone is Android 16, June update.

https://t.co/uIIAzHwnB7

I have detailed notes on flashing, exploitation, offset finding etc, blog post later 🖖

[ThreatWire @ThreatWire_]

🚨 A public PoC has been released for CVE-2026-57827 affecting the RSFiles extension for Joomla.

The flaw allows unauthenticated file upload, potentially leading to full RCE.

🔗 https://t.co/NAiaXK9j9K

#Joomla #RCE #CVE #CyberSecurity

[moton @moton]

CVE-2026-50502: PoC Exploit Public for Event Log RCE - https://t.co/875EYFr3Fb

[Florian Hansemann @CyberWarship]

''GitHub - grizzzer/CVE-2026-42978-PoC-Research: CVE-2026-42978 — Use-After-Free race condition in Windows Push Notifications (WpnService). Patch diff, root cause analysis, TOCTOU lab, Sysmon/ETW detection rules.''

#infosec #pentest #redteam #blueteam
https://t.co/LSrtDOx3hx

[ɐpnH @AlAssaf_H]

Windows Push Notifications Use-After-Free CVE-2026-42978 Proof-of-Content and Research

https://t.co/neHOp2OXQt